What Are Data Subprocessors? A Guide for Nigerian Fintechs and Banks

When a bank or fintech collects your personal information, it may rely on other companies to help process and protect that data. But what happens when those companies also hire third parties?

This is where data subprocessors come in. If your financial institution uses an identity verification provider, cloud storage service or another technology vendor, understanding who handles your customers’ data is important.

Let us look at what a data subprocessor does, how it relates to Nigerian data protection laws and how your business can manage the risks.

What Is a Data Subprocessor?

A data subprocessor is a third-party company hired by a data processor to handle personal information on its behalf.

For example, a fintech may hire an identity verification (IDV) provider to verify customers’ identities. If the IDV provider uses another company to host its verification system or store customer records, that company may be a data subprocessor.

To understand the relationship, let us look at three roles.

• Data controller: The organisation that decides why and how personal data should be used. For example, a Nigerian bank that needs to verify new customers.

• Data processor: The company that processes personal data for the controller. For example, an IDV provider that checks customers’ identity documents.

• Data subprocessor: A company hired by the processor to perform part of that work. For example, a cloud service provider that hosts the IDV system and its records.

The exact role depends on what each company actually does and not its job title only.

How Does This Work in Practice?

Imagine a Nigerian fintech onboarding a new customer.

1. The fintech collects the customer's name and identification details.

2. It sends the necessary information to an IDV provider to verify the customer's identity.

3. The IDV provider uses a cloud hosting company to run its system and store relevant records.

In this example, the fintech is the data controller, the IDV provider is the data processor, and the cloud hosting company may be the data subprocessor.

That is how third-party data processors and subprocessors can become part of the same customer verification process.

What Does a Data Subprocessor Do?

A data subprocessor handles specific tasks that help a data processor deliver its service. For example, an IDV provider may use a cloud company to host customer information or another service to support identity checks.

Depending on the agreement, a data subprocessor may have the following duties:

• Hosting and storage: Keeping customer records and verification results on secure systems.

• Following instructions: Using personal data only for the agreed purpose and according to the processor’s instructions.

• Protecting customer information: Using security measures such as encryption, access controls and multi-factor authentication to prevent unauthorised access.

• Maintaining confidentiality: Ensuring that employees and other authorised personnel handle customer information responsibly.

• Reporting data breaches: Promptly informing the data processor when a data breach occurs and sharing details about the incident, its likely impact and steps being taken to address it.

• Supporting customer data requests: Helping the processor respond when individuals ask to access, correct or delete their personal information, where applicable.

• Providing compliance information: Sharing details about its data handling practices and security measures when needed to demonstrate compliance.

• Getting approval before subcontracting further: Following the agreed approval process before hiring another company to handle the data.

• Supporting data deletion: Returning or deleting personal information when required by the agreement or when the service ends, subject to applicable legal obligations.

These duties should be clearly stated in the contract between the processor and the subprocessor. The exact requirements depend on the agreement and the applicable data protection laws.

For Nigerian fintechs and banks, the key point is simple: your service provider should know who handles your customers’ information, how it is protected and what happens if something goes wrong.

What Does the Nigeria Data Protection Act Say About Subprocessors?

The Nigeria Data Protection Act (NDPA) 2023 addresses situations where a data controller hires a processor or a processor hires another processor.

Under Section 29, organisations engaging processors must ensure that appropriate safeguards are in place. These include requiring processors to follow applicable data protection requirements, protect personal information, assist with data subject requests and provide information needed to demonstrate compliance with data protection in Nigeria.

The Act also addresses the engagement of another processor and requires a written agreement between the relevant parties. You can read the  NDPA Act 2023 on the Nigeria Data Protection Commission website.

In simple terms, if your identity verification provider uses another company to process customer data, you should understand that arrangement and ensure the necessary safeguards are in place.

You should also check whether additional rules apply to your institution, particularly if you operate in a regulated sector or transfer personal data outside Nigeria.

Why Use a Data Subprocessor, and How Can You Manage the Risks?

Working with a data subprocessor can help a technology provider access specialist tools, reliable infrastructure and services it may not be able to build itself.

For a bank or fintech, this can support services such as customer verification and secure data storage without requiring every part of the technology to be developed in-house.

However, there are risks. A subprocessor may have weak security, use customer data beyond the agreed purpose or experience a data breach. You may also have limited visibility into where information is stored or who can access it.

Here are practical tips to get started with vendor risk management in accordance with data protection in Nigeria:

1. Know who handles your data. Ask your provider to identify its subprocessors and explain what each one does.

2. Check their security. Review relevant security controls, certifications and data protection practices.

3. Understand where data goes. Confirm where personal information is stored, who can access it and whether it is transferred outside Nigeria.

4. Put responsibilities in writing. Use clear contracts that explain how data must be handled and protected.

5. Review the arrangement regularly. Ask providers to notify you about changes to their subprocessors and review any new risks.

These steps support stronger third-party risk management and help you make informed decisions about the companies handling your customers’ information.

What Should a Data Processing Agreement Include?

A Data Processing Agreement (DPA) is a written agreement that explains how a company may process personal data for another organisation.

Before signing a data processing agreement, check that it clearly explains:

• Purpose and scope: What data will be processed and why.

• Security requirements: How the parties will protect personal information.

• Subprocessor arrangements: When a processor can engage another company and how changes will be communicated.

• Data breach reporting: Who must be notified and how incidents will be handled.

• Data subject requests: How the parties will help individuals exercise their rights.

• Data retention and deletion: What happens to customer data when it is no longer needed or the service ends.

• Data location and transfers: Where information will be processed and what safeguards apply to international transfers.

A good data processing agreement makes each party’s responsibilities clear. It should also align with the main service contract and applicable requirements for data protection in Nigeria.

How Can Financial Institutions Protect Customer Data When Using Third Parties?

Protecting customer information requires more than signing a contract. Your institution needs to understand which companies handle personal data and how they protect it.

Use this checklist to strengthen your approach:

• Keep an up-to-date list of your processors and their subprocessors.

• Limit the personal information shared to what the service actually needs.

• Confirm that access is restricted to authorised people.

• Review providers’ security practices and relevant compliance evidence.

• Agree on how incidents, customer requests and changes to subprocessors will be handled.

• Check that data is returned or securely deleted when the contract ends, where required.

• Reassess providers regularly, especially when their services or data handling practices change.

For more guidance, read our related articles on:
How KYC and AML providers protect customer data 

Data residency requirements for KYC under Nigeria’s NDPA. 

Effective third-party risk management is an ongoing process. Regular checks help you identify gaps before they affect your customers or business.

Choose a KYC and AML Partner You Can Trust

Whether acting as a data processor or engaging subprocessors, protecting customer information requires clear responsibilities, strong security controls and transparency.

If your team is reviewing KYC or AML providers and wants a partner that takes data protection seriously, book a free demo with us today.